CVE-2023-39852

Summary

CVE-2023-39852: Doctormms v1.0 is reported to have a SQL injection vulnerability that can be potentially exploited through the $userid parameter in myAppoinment.php. However, this claim is disputed by a third party who argues that the userid is a session variable controlled by the server, making it unlikely to be manipulated for malicious purposes. The original reporter, on the other hand, asserts that the userid originates from an uncontrolled $_POST variable at line 68 in doctors/doctorlogin.php. The validity of this vulnerability remains controversial.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.